CVE-2023-20725: In preloader, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is no...

Summary

In preloader, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07734004 / ALPS07874358 (For MT6880, MT6890, MT6980, MT6990 on...

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
rdkcentral	rdk-b	2022q3 `cpe:2.3:a:rdkcentral:rdk-b:2022q3:::::::*`
google	android	12.0 13.0 `cpe:2.3:o:google:android:12.0:::::::*`
openwrt	openwrt	19.07.0 21.02.0 `cpe:2.3:o:openwrt:openwrt:19.07.0:-::::::`

Original advisory text

In preloader, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is no...

In preloader, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07734004 / ALPS07874358 (For MT6880, MT6890, MT6980, MT6990 only); Issue ID: ALPS07734004 / ALPS07874358 (For MT6880, MT6890, MT6980, MT6990 only).

References

https://corp.mediatek.com/product-security-bulletin/June-2023 Vendor Advisory